MAL-2026-17453

    Dashboard / Malicious Package / MAL-2026-17453

    MAL-2026-17453

    Published: 2 Oct 2026Last Modified: 2 Oct 2026

    Summary: Malicious code in gocommunity.io/orderedbtree (Go)

    Details: Part of the Graphalgo campaign. The module, first published around 2026-08-11, contains a second-stage remote access trojan in plaintext that runs automatically. The RAT collects system information, executes decrypted Go or JavaScript payloads, and polls two command-and-control channels every 3-10 seconds: an Ethereum smart contract used as a dead drop (Arbitrum Sepolia) and a Slack bot token.

    References: https://www.aikido.dev/blog/graphalgo-terraform-go-modules

    Affected packages

    Package

    Name: gocommunity.io/orderedbtree

    Purl: pkg:golang/gocommunity.io/orderedbtree

    Affected ranges

    Type: SEMVER

    Events:

    Introduced- 0
    Fixed -None

    Affected versions